Beyond Distribution: Empirical Validation of Entity-Level Defense in Multi-Model AI Decision Protection

The Distribution Hypothesis (Chang, 2026) established that controlled fragment allocation — not fragmentation alone — determines AI decision protection, achieving 81.3% ± 3.1% pass rate under collaborative multi-model reconstruction attacks. This paper presents empirical evidence from 50 queries across 7 frontier AI models over 3 runs with fixed random seed (seed=42) addressing two open questions: whether additional defense layers can push protection above 90%, and whether text similarity accurately measures protection when defense mechanisms operate at the entity level. We introduce Semantic Surrogate — entity replacement with plausible fiction — and entity-weighted DA. Under L2+L3 defense, text-based DA pass rate improves to 93.3% ± 1.2% (McNemar's exact test, p < 0.001), with entity recovery dropping to 0.023 ± 0.006. Entity-weighted DA reaches 97.3% ± 1.2%. Ablation baselines reveal that naive redaction is an anti-defense (54.7%, −20.0pp vs baseline), while response utility analysis shows Semantic Surrogate is the only method satisfying both defense and utility feasibility constraints. We identify domain vocabulary leakage as a boundary condition requiring behavioral-layer defense (MSBA). Version 2.4.